CMMC in 2026: Levels, Phase 2 Suspension and What Contractors Must Do

CMMC, the Cybersecurity Maturity Model Certification, is how the US Department of Defense set out to verify that the companies in its supply chain actually protect sensitive information. For years, contractors self-attested to NIST SP 800-171 compliance; CMMC was created because many attestations did not match reality. It defines three levels and was being phased into contracts from November 2025.

2026 changed the picture. In July 2026 the department suspended Phase 2 of the rollout, which would have required third-party certification in many contracts from 10 November 2026, and launched a review of the program. A September 2026 class deviation removed third-party assessment requirements from solicitations while keeping baseline cybersecurity obligations. This guide explains the levels, the rules, what still applies today, and how software and IT companies in the defence supply chain should prepare. Because the program's status is changing, this guide is reviewed every three months; check official DoD sources before acting.

What is CMMC?

CMMC is a DoD program that sets cybersecurity requirements for contractors and assesses whether they are met, with the result recorded in the Supplier Performance Risk System (SPRS) and used in contract award decisions. It protects two kinds of information:

• Federal contract information (FCI): information not intended for public release that is provided by or generated for the government under a contract. Basic safeguarding of FCI is required by FAR 52.204-21.
• Controlled Unclassified Information (CUI): sensitive information requiring safeguarding under law, regulation or government-wide policy, protected under NIST SP 800-171 through DFARS 252.204-7012.

CMMC does not create new security requirements so much as verify existing ones. Its rules are in two places: the program rule at 32 CFR Part 170, and the acquisition rule in the DFARS, which puts CMMC requirements into contracts.

History and why CMMC was introduced

DFARS 252.204-7012 required DoD contractors to implement NIST SP 800-171 by the end of 2017, but compliance was self-attested. DoD Inspector General reviews and DoD assessments found significant gaps. The first version of CMMC (2020) proposed five maturity levels with third-party certification for all. After industry concerns about cost, the department announced CMMC 2.0 in November 2021, simplifying to three levels and allowing self-assessment for some.

The program rule (32 CFR Part 170) was published in October 2024 and took effect in December 2024. The acquisition rule was published in September 2025 and took effect on 10 November 2025, starting a four-phase rollout. In July 2026 the department suspended Phase 2 and subsequent phases and commissioned a review; a task force reported to the DoD CIO in September 2026. At our last review, the review's outcome had not been published and no restart date had been set.

The three CMMC levels

Level	Information	Requirements	Assessment (as designed)
Level 1 (Foundational)	FCI	15 basic safeguarding requirements from FAR 52.204-21	Annual self-assessment and annual affirmation in SPRS
Level 2 (Advanced)	CUI	110 requirements of NIST SP 800-171 Revision 2	Self-assessment or certification by an authorised C3PAO every three years, as the contract specifies, with annual affirmation
Level 3 (Expert)	CUI in the highest-priority programs	Level 2 plus 24 selected requirements from NIST SP 800-172	Level 2 C3PAO certification, then assessment by DCMA's Defense Industrial Base Cybersecurity Assessment Center every three years, with annual affirmation

A senior official must affirm continuing compliance annually. Limited use of plans of action and milestones (POA&Ms) is allowed at Levels 2 and 3 for conditional status, with a minimum score and a deadline for closing items, and some requirements cannot be left open.

The phased rollout and the 2026 suspension

Phase	Planned start	Planned requirement	Status at our last review
Phase 1	10 November 2025	Level 1 and Level 2 self-assessments in applicable solicitations	In effect
Phase 2	10 November 2026	Level 2 C3PAO certification in applicable solicitations	Suspended in July 2026; a September 2026 class deviation removed third-party assessment requirements from solicitations
Phase 3	10 November 2027	Level 3 DIBCAC assessments; Level 2 certification at option periods	On hold with Phase 2
Phase 4	10 November 2028	Full implementation in all applicable contracts	On hold with Phase 2

What still applies during the suspension

• DFARS 252.204-7012: implement NIST SP 800-171, report cyber incidents within 72 hours, use FedRAMP Moderate equivalent cloud services for covered defence information, and flow requirements down.
• DFARS 252.204-7019 and 7020: a current NIST SP 800-171 DoD Assessment score in SPRS.
• FAR 52.204-21 basic safeguarding of FCI.
• CMMC Phase 1 self-assessment and affirmation requirements where included in contracts.
• False Claims Act exposure for inaccurate representations, which is unaffected by the suspension.

Who needs CMMC?

• Prime contractors and subcontractors at every tier that process, store or transmit FCI or CUI in performing DoD contracts.
• Software developers and IT service providers whose staff or systems handle FCI or CUI for defence customers.
• Managed service providers and cloud service providers that are part of a contractor's assessment scope as external service providers.
• Foreign companies in the DoD supply chain.

Commercial off-the-shelf product suppliers are generally exempt. Companies that never handle FCI or CUI do not need CMMC, though customers may still ask.

What software and IT companies should know about scope

CMMC scoping is where many technology suppliers either overspend or get caught out. The scoping guidance sorts assets into categories:

• CUI assets that process, store or transmit CUI, which are fully assessed.
• Security protection assets that provide security functions to the CUI environment, such as the identity provider, SIEM, endpoint protection console and the managed service provider's tools, which are also assessed.
• Contractor risk managed assets that could, but are not intended to, handle CUI, which must be documented and protected by policy.
• Specialised assets such as test equipment, IoT and operational technology, and government property, which are documented and handled differently.
• Out-of-scope assets that cannot process, store or transmit CUI and are separated from the CUI environment.

For a software company, the decisions that matter most are where developers work with CUI (dedicated devices and a separate tenant, or the corporate environment), whether code repositories and ticketing systems will ever contain CUI, and which external service providers are in scope. A managed service provider that administers your CUI environment becomes part of your assessment, so choose one that is prepared for it. Writing these decisions down, with a diagram, is the foundation of the system security plan.

Products and services sold to contractors

If you sell software or a cloud service that contractors use for CUI, your customers will ask you about it during their own assessments. A cloud service storing CUI must meet FedRAMP Moderate or equivalent requirements under DFARS 7012. Installed software will be judged on whether it lets the customer meet the requirements: MFA and SSO integration, configurable session controls, audit logs, FIPS-validated cryptography, role-based access and secure configuration options. A short document mapping your features to the relevant requirements saves every customer time and makes your product easier to approve.

How to prepare, step by step

1. Identify FCI and CUI in your contracts and systems, and the level each contract specifies.
2. Scope the assessment: CUI assets, security protection assets, contractor risk managed assets, specialised assets and out-of-scope assets, as defined in the CMMC scoping guidance. Consider an enclave.
3. Use compliant external service providers: FedRAMP Moderate or equivalent cloud services for CUI, and managed service providers prepared for assessment.
4. Implement and self-assess against the 15 Level 1 or 110 Level 2 requirements using the CMMC assessment guides.
5. Write and maintain the system security plan and any POA&M.
6. Post scores and affirmations in SPRS as required.
7. Keep evidence ready for a C3PAO or DIBCAC assessment, so you can move quickly when third-party requirements return in whatever form.
8. Flow down requirements to subcontractors and confirm their status.
9. Watch official announcements on the review outcome.

Documentation required

• System security plan covering the assessment scope.
• Network diagrams, data flows and asset inventory by CMMC asset category.
• Policies and procedures for each requirement family.
• Evidence of implementation for each requirement: configurations, logs, training records, access reviews, incident records.
• POA&M where permitted.
• Self-assessment results, SPRS submissions and annual affirmations.
• External service provider documentation, including FedRAMP status or equivalency and responsibility matrices.

Assessment and certification

As designed, Level 1 is self-assessed annually; Level 2 is self-assessed or certified by a C3PAO authorised by the Cyber AB, with assessors certified through the program's ecosystem; and Level 3 is assessed by DIBCAC after Level 2 certification. Certificates and self-assessments are valid for three years at Levels 2 and 3, subject to annual affirmations. During the suspension, contractors that already hold C3PAO certifications keep them, and voluntary assessments have continued to be available; check current guidance.

Timeline and cost considerations

Preparation for Level 2 commonly takes many months for organisations starting from a low baseline, because the 110 requirements touch identity, devices, logging, encryption, configuration, training and documentation. Cost drivers include compliant cloud services, endpoint and identity tooling, FIPS-validated encryption, logging, consultants, the C3PAO assessment itself, and staff time. The suspension does not reduce the cost of meeting NIST SP 800-171, which remains a contractual requirement; it changes when and how verification will be required.

Benefits and consequences of non-compliance

Meeting the requirements keeps you eligible for DoD work, protects sensitive data, and positions you ahead of competitors when verification resumes. Primes increasingly choose subcontractors who can show strong SPRS scores and evidence.

Consequences of non-compliance include ineligibility for award where CMMC is required, contract remedies, damage to relationships with primes, and False Claims Act liability for misrepresentations. The Department of Justice has announced settlements with contractors over cybersecurity misrepresentations under its Civil Cyber-Fraud Initiative.

Common mistakes and challenges for IT companies

• Treating the suspension as a reprieve from NIST SP 800-171. The underlying DFARS duties still apply.
• Inaccurate SPRS scores that do not match the system security plan.
• Uncontrolled scope: CUI in email, file shares and developer laptops.
• Non-compliant cloud services for CUI.
• Weak evidence: policies without proof of operation.
• Ignoring subcontractors and service providers in the flow-down.

Best practices, tools and technologies

• Build a CUI enclave on a government-community cloud with dedicated identities and managed devices.
• Use phishing-resistant MFA, conditional access and privileged access management.
• Deploy FIPS-validated encryption for CUI at rest and in transit.
• Centralise logs with review and alerting.
• Maintain the system security plan and evidence in a structured repository mapped to each requirement.
• Run a mock assessment against the CMMC assessment guide before any real one.

We help clients with the application and hosting parts of a CUI environment through our support plans and migrations.

How CMMC relates to other frameworks

Framework	Relationship
NIST SP 800-171	The requirements CMMC Level 2 verifies.
NIST SP 800-53	The source catalogue behind SP 800-171 and SP 800-172.
FedRAMP	Cloud services handling CUI must meet FedRAMP Moderate or equivalent.
FISMA	Federal systems law; CMMC covers contractors' own systems.
ISO/IEC 27001	A useful management system; not a substitute for CMMC.

Real-world implementation examples

Before the suspension, a growing number of contractors obtained Level 2 certifications from authorised C3PAOs, and primes began asking subcontractors for their status. The department's July 2026 decision followed industry feedback on cost and capacity; the department reported receiving more than a thousand responses to its request for information during the review.

An illustrative case for a small software firm supplying a prime: it handles CUI in the form of interface specifications. It builds an enclave, completes a Level 2 self-assessment, posts an accurate score in SPRS, and keeps a ready evidence pack. When the prime asks for its CMMC status during the suspension, the firm can show its score, system security plan and evidence, and is ready for a C3PAO assessment if and when it returns.

Next steps

1. Confirm which contracts involve FCI or CUI and their CMMC clauses.
2. Keep meeting DFARS 7012 and posting accurate SPRS scores.
3. Complete or refresh your self-assessment and system security plan.
4. Close gaps so you are ready for third-party assessment.
5. Monitor official announcements on the program review.

Frequently asked questions

Is CMMC suspended?

Phase 2 and later phases were suspended in July 2026 pending a program review, and a September 2026 class deviation removed third-party assessment requirements from solicitations. Phase 1 self-assessment requirements and the underlying DFARS duties continued to apply at our last review.

What are the CMMC levels?

Level 1 for federal contract information, Level 2 for CUI based on NIST SP 800-171, and Level 3 for the highest-priority CUI with selected NIST SP 800-172 requirements.

Does CMMC apply to subcontractors?

Yes. Requirements flow down to subcontractors at all tiers that handle FCI or CUI.

Does CMMC apply to foreign companies?

Yes, to foreign companies in the DoD supply chain that handle FCI or CUI.

What is a C3PAO?

A CMMC third-party assessment organisation authorised by the Cyber AB to perform Level 2 certification assessments.

What is SPRS?

The Supplier Performance Risk System, where contractors post NIST SP 800-171 assessment scores and CMMC status and affirmations.

Can we have open items and still pass?

The rules allow conditional status with a POA&M for some requirements if a minimum score is met, with a deadline to close items. Some requirements cannot be left open.

Is NIST 800-171 still required during the CMMC pause?

Yes. DFARS 252.204-7012 and related clauses still require it for contractors handling covered defence information.

Which NIST 800-171 revision does CMMC use?

Revision 2, with 110 requirements.

How long is a CMMC certification valid?

Three years for Levels 2 and 3, with annual affirmations of continued compliance.

Does a managed service provider need CMMC?

If it provides security functions to, or administers, a contractor's CUI environment, it is part of that contractor's assessment scope, and contractors increasingly expect such providers to be ready for assessment.

What should we do now?

Keep implementing NIST SP 800-171, keep your SPRS score accurate, maintain evidence, and watch for the outcome of the department's review.